@celigo/api-specs 0.2.134 → 0.2.135

package/dist/api.yml

@@ -5015,6 +5015,12 @@ components:
               type: boolean
               description: When true, the connection has been taken offline and is skipped during flow execution.
               readOnly: true
+            needsAuthorization:
+              type: boolean
+              readOnly: true
+              description: |-
+                OAuth handshake state. Celigo's OAuth callback sets it to `false` once the user consents
+                and the tokens are stored (see `GET /v1/connection/{_id}/oauth2`).
             _sourceId:
               type: string
               format: objectId
@@ -6071,7 +6077,7 @@ components:
             OAuth 2.0 redirect URI (callback URL) registered with the API provider.
             Must exactly match the redirect URI configured in the OAuth application registration.
           examples:
-            - https://api.integrator.io/connection/oauth2callback
+            - https://integrator.io/connection/oauth2callback
         useIClientFields:
           type: boolean
           description: |
@@ -9927,7 +9933,7 @@ components:
 
           ## REQUIRED FIELDS
           - pingFunction (name of the function that tests connection health)
-          - _stackId (set on the parent connection object — references the Celigo Stack)
+          - _stackId (inside this object, as `wrapper._stackId` — references the Celigo Stack)
 
           ## CUSTOM FIELDS
           Use encrypted/unencrypted fields to store connection-specific configuration.

package/dist/connection.yml

@@ -2438,7 +2438,8 @@ paths:
         Returns the buffered debug log stream for the connection — request/response pairs from
         recent exports, imports, and lookups that used it. Capture is gated by the connection's
         `debugDate`: logs are recorded only while `debugDate` is in the future, so enable it first
-        via `PUT /v1/connections/{_id}` or the buffer stays empty.
+        with `PATCH /v1/connections/{_id}` on `/debugDate` (credential-safe, unlike a full `PUT`)
+        or the buffer stays empty.
 
         The response is a plain-text stream (not JSON): each entry is a header line
         (`timestamp traceKey resourceType resourceId`) followed by a single-line JSON payload,
@@ -2494,11 +2495,11 @@ paths:
 
         Idempotent — works whether the buffer held entries, was already empty, or the given
         connection id does not exist. Does **not** clear the connection's `debugDate` — debug
-        capture remains enabled until `debugDate` expires or is removed via a PUT.
+        capture remains enabled until `debugDate` expires or is removed.
 
         Useful between test runs to isolate logs for a single scenario. To fully
-        disable debug capture, also `PUT /v1/connections/{_id}` with `debugDate`
-        removed from the body.
+        disable debug capture, also send `PATCH /v1/connections/{_id}` with a `remove`
+        operation on `/debugDate`.
       parameters:
         - name: _id
           in: path
@@ -4126,6 +4127,12 @@ components:
               type: boolean
               description: When true, the connection has been taken offline and is skipped during flow execution.
               readOnly: true
+            needsAuthorization:
+              type: boolean
+              readOnly: true
+              description: |-
+                OAuth handshake state. Celigo's OAuth callback sets it to `false` once the user consents
+                and the tokens are stored (see `GET /v1/connection/{_id}/oauth2`).
             _sourceId:
               type: string
               format: objectId
@@ -5182,7 +5189,7 @@ components:
             OAuth 2.0 redirect URI (callback URL) registered with the API provider.
             Must exactly match the redirect URI configured in the OAuth application registration.
           examples:
-            - https://api.integrator.io/connection/oauth2callback
+            - https://integrator.io/connection/oauth2callback
         useIClientFields:
           type: boolean
           description: |
@@ -9038,7 +9045,7 @@ components:
 
           ## REQUIRED FIELDS
           - pingFunction (name of the function that tests connection health)
-          - _stackId (set on the parent connection object — references the Celigo Stack)
+          - _stackId (inside this object, as `wrapper._stackId` — references the Celigo Stack)
 
           ## CUSTOM FIELDS
           Use encrypted/unencrypted fields to store connection-specific configuration.
@@ -10441,7 +10448,7 @@ components:
             Embeds a one-time token in the `state` query parameter that expires quickly and is
             invalidated after a single use.
           examples:
-            - https://login.example.com/oauth2/authorize?response_type=code&client_id=0oa1b2c3d4EXAMPLE5&redirect_uri=https%3A%2F%2Fapi.integrator.io%2Fconnection%2Foauth2callback&scope=read+write&state=eyJfY29ubmVjdGlvbklkIjoiNjE1ZGZhMDc0Mjc2MzY3MTI3NWI3MGFiIn0
+            - https://login.example.com/oauth2/authorize?response_type=code&client_id=0oa1b2c3d4EXAMPLE5&redirect_uri=https%3A%2F%2Fintegrator.io%2Fconnection%2Foauth2callback&scope=read+write&state=eyJfY29ubmVjdGlvbklkIjoiNjE1ZGZhMDc0Mjc2MzY3MTI3NWI3MGFiIn0
     DependencyEntry:
       type: object
       description: A single resource that depends on the queried resource.

package/dist/enduser.yml

@@ -2227,6 +2227,12 @@ components:
               type: boolean
               description: When true, the connection has been taken offline and is skipped during flow execution.
               readOnly: true
+            needsAuthorization:
+              type: boolean
+              readOnly: true
+              description: |-
+                OAuth handshake state. Celigo's OAuth callback sets it to `false` once the user consents
+                and the tokens are stored (see `GET /v1/connection/{_id}/oauth2`).
             _sourceId:
               type: string
               format: objectId
@@ -3283,7 +3289,7 @@ components:
             OAuth 2.0 redirect URI (callback URL) registered with the API provider.
             Must exactly match the redirect URI configured in the OAuth application registration.
           examples:
-            - https://api.integrator.io/connection/oauth2callback
+            - https://integrator.io/connection/oauth2callback
         useIClientFields:
           type: boolean
           description: |
@@ -7139,7 +7145,7 @@ components:
 
           ## REQUIRED FIELDS
           - pingFunction (name of the function that tests connection health)
-          - _stackId (set on the parent connection object — references the Celigo Stack)
+          - _stackId (inside this object, as `wrapper._stackId` — references the Celigo Stack)
 
           ## CUSTOM FIELDS
           Use encrypted/unencrypted fields to store connection-specific configuration.

package/dist/iclient.yml

@@ -324,7 +324,9 @@ paths:
         account: every update must include the full JSON key. An Azure
         service principal keeps its stored `clientSecret` or `certificate`
         when the field is omitted — only a new value replaces it, and
-        `certificate` is never returned.
+        `certificate` is never returned. Connections work the other way:
+        re-sending the mask on `PUT /v1/connections/{_id}` clears the stored
+        credential.
       operationId: updateIClient
       tags:
         - iClients
@@ -487,8 +489,9 @@ paths:
       x-internal: false
       summary: Delete an iClient
       description: |-
-        Permanently deletes an iClient. Blocked if the iClient is still
-        referenced by a connection.
+        Permanently deletes an iClient. Blocked while any connection references
+        it, including a deleted connection still in the recycle bin: purge that
+        connection with `DELETE /v1/recycleBinTTL/connections/{_id}` first.
       operationId: deleteIClient
       tags:
         - iClients
@@ -508,7 +511,20 @@ paths:
         '404':
           $ref: '#/components/responses/404-not-found'
         '422':
-          $ref: '#/components/responses/422-unprocessable-entity'
+          description: |-
+            A connection still references the iClient. A deleted connection in the
+            recycle bin counts until it is purged.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              examples:
+                referencedByBinnedConnection:
+                  summary: A deleted connection still in the recycle bin references the iClient
+                  value:
+                    errors:
+                      - code: delete_not_allowed
+                        message: 'this document is referenced by Connection : 6a1b2c3d4e5f60718293a4b5'
   /v1/iclients/{_id}/dependencies:
     get:
       x-internal: false
@@ -1366,7 +1382,7 @@ components:
                   It is used in OAuth 2.0 authorization flows to receive authorization codes or
                   access tokens securely.
               examples:
-                - https://api.integrator.io/connection/oauth2callback
+                - https://integrator.io/connection/oauth2callback
                 - https://client.example.com/callback
                 - https://app.example.com/oauth2/callback
                 - https://localhost:8080/auth/callback
@@ -2165,7 +2181,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plain password value here to set/update it.
-                  - To keep the existing password unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored password on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Use `password` for the OAuth2 password value used with the password grant;
                   this is the value provided to configure or update the iClient,
@@ -3166,7 +3182,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plaintext consumer key here to set/update it.
-                  - To keep the existing value unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored value on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Set the NetSuite consumer key value used for authentication;
                   provide this value to configure or update the iClient.
@@ -3192,7 +3208,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plaintext consumer secret here to set/update it.
-                  - To keep the existing value unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored value on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   The NetSuite consumer secret value used for authentication;
                   provide this value to configure or update the iClient.
@@ -3336,7 +3352,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plain client secret value here to set/update it.
-                  - To keep the existing secret unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored secret on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Use the Salesforce OAuth **client secret** value to configure or update the Salesforce iClient;
                   integrator.io stores this secret encrypted at rest internally (for example as
@@ -3425,7 +3441,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plaintext private key value here to set/update it (often PEM formatted).
-                  - To keep the existing private key unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored private key on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Set the Salesforce private key value used for authentication flows such as JWT
                   bearer token OAuth;
@@ -3693,7 +3709,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plaintext certificate ID value here to set/update it.
-                  - To keep the existing value unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored value on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Use the eBay certificate ID value for authentication;
                   this is the value you provide to configure or update the iClient. integrator.io
@@ -3906,7 +3922,7 @@ components:
                 - |-
                   ## IMPLEMENTATION GUIDANCE:
                   - Provide the plaintext secret key value here to set/update it.
-                  - To keep the existing value unchanged during an update, omit this field (or keep `"******"` as-is if returned).
+                  - To keep the stored value on a PUT, re-send `"******"` (the masked value GET returns) unchanged; never omit this field to keep it.
                 - |-
                   Use the Amazon MWS secret key value for authentication;
                   provide this value to configure or update the iClient.
@@ -4555,18 +4571,5 @@ components:
                 errors:
                   - code: not_found
                     message: The requested resource was not found.
-    422-unprocessable-entity:
-      description: |
-        Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/Error'
-          examples:
-            default:
-              value:
-                errors:
-                  - code: unprocessable_entity
-                    message: The request could not be processed due to a semantic error.
 x-enable-proxy: true
 x-internal: false

package/dist/mcp-server.yml

@@ -4052,6 +4052,12 @@ components:
               type: boolean
               description: When true, the connection has been taken offline and is skipped during flow execution.
               readOnly: true
+            needsAuthorization:
+              type: boolean
+              readOnly: true
+              description: |-
+                OAuth handshake state. Celigo's OAuth callback sets it to `false` once the user consents
+                and the tokens are stored (see `GET /v1/connection/{_id}/oauth2`).
             _sourceId:
               type: string
               format: objectId
@@ -5108,7 +5114,7 @@ components:
             OAuth 2.0 redirect URI (callback URL) registered with the API provider.
             Must exactly match the redirect URI configured in the OAuth application registration.
           examples:
-            - https://api.integrator.io/connection/oauth2callback
+            - https://integrator.io/connection/oauth2callback
         useIClientFields:
           type: boolean
           description: |
@@ -8964,7 +8970,7 @@ components:
 
           ## REQUIRED FIELDS
           - pingFunction (name of the function that tests connection health)
-          - _stackId (set on the parent connection object — references the Celigo Stack)
+          - _stackId (inside this object, as `wrapper._stackId` — references the Celigo Stack)
 
           ## CUSTOM FIELDS
           Use encrypted/unencrypted fields to store connection-specific configuration.

package/dist/tool.yml

@@ -7380,6 +7380,12 @@ components:
               type: boolean
               description: When true, the connection has been taken offline and is skipped during flow execution.
               readOnly: true
+            needsAuthorization:
+              type: boolean
+              readOnly: true
+              description: |-
+                OAuth handshake state. Celigo's OAuth callback sets it to `false` once the user consents
+                and the tokens are stored (see `GET /v1/connection/{_id}/oauth2`).
             _sourceId:
               type: string
               format: objectId
@@ -8436,7 +8442,7 @@ components:
             OAuth 2.0 redirect URI (callback URL) registered with the API provider.
             Must exactly match the redirect URI configured in the OAuth application registration.
           examples:
-            - https://api.integrator.io/connection/oauth2callback
+            - https://integrator.io/connection/oauth2callback
         useIClientFields:
           type: boolean
           description: |
@@ -12292,7 +12298,7 @@ components:
 
           ## REQUIRED FIELDS
           - pingFunction (name of the function that tests connection health)
-          - _stackId (set on the parent connection object — references the Celigo Stack)
+          - _stackId (inside this object, as `wrapper._stackId` — references the Celigo Stack)
 
           ## CUSTOM FIELDS
           Use encrypted/unencrypted fields to store connection-specific configuration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.134",
+  "version": "0.2.135",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [

package/schemas.json

@@ -1,7 +1,7 @@
 {
 	"provenance": {
 		"repo": "celigo/integrator-api-specs",
-		"iasCommit": "86f54b3d",
+		"iasCommit": "db3dbe3d",
 		"generatedAt": "2026-10-21"
 	},
 	"roots": {
@@ -2275,6 +2275,7 @@
 				"lastModified": 1,
 				"microServices": 224,
 				"name": 1,
+				"needsAuthorization": 9,
 				"offline": 9,
 				"pgp": 220,
 				"queues": 226,
@@ -3626,6 +3627,7 @@
 				"microServices": 224,
 				"mongodb": 291,
 				"name": 1,
+				"needsAuthorization": 9,
 				"netsuite": 232,
 				"offline": 9,
 				"pgp": 220,